Skip to main content
ForgetItNet
ForgetItNet
Explorer II
May 8, 2025
Question

getting Invalid Length of Value when trying to select a Firewall group in IKEV2 IPsec settings

  • May 8, 2025
  • 4 replies
  • 1928 views

Hi all,

I'm trying to move away from the SSL VPNs we have and setup IPSec and if i use the basic wizard this all works but it then defaults to IKEV1 so i set it as a custom tunnel and selected IKEV2 but when i then change the "accept types" to Peer ID from Dialup Group and then select the same group we use in the SSL config i then get "invalid length of value" ? There doesn't seem to be much information on this that i can find apart from a few posts saying the group has to be either setup locally or of the type "firewall" which this is ? 

If i choose IKEV1 and use XAUTH then it accepts the group without any issue.

any help would be great.

Thanks

4 replies

ForgetItNet
ForgetItNetAuthor
Explorer II
May 8, 2025

Also to add that if I create a new group with a local user in it then it doesn't show the error and allows me to select it but then Phase1 completes but I get an error stating "no response from peer" and no Phase 2 is even started. We've got a FortiGate Analyser and that also just shows the Phase1 connecting successfully but nothing is in there about Phase 2 but again if I set it to allow ANY peer and turn EAP off on the FortClient (so there's no username or password) then it works fine and connects ?

yderek
Staff
yderek
Staff
May 8, 2025

@ForgetItNet  What kind of the user group you are using in SSL that giving you error when you apply to IKEv2 ? Is that SAML group or LDAP group ?

    ForgetItNet
    ForgetItNetAuthor
    Explorer II
    May 9, 2025

    Hi Yderek, so I'm not 100% in what it classes as so we have a local group of users that we add people to for access to the VPN but we add people to this from an LDAP integration i.e we can search LDAP, right click the person and then get the option to add them and they then show up in the local list.

    yderek
    Staff
    yderek
    Staff
    May 8, 2025

    Please also upload the group screenshot to here or using command  'show user group ' 

      ForgetItNet
      ForgetItNetAuthor
      Explorer II
      May 9, 2025

      This is a TCapture.PNG

      This is a screenshot of that "show user group" command, i've redacted a lot as it's got usernames etc in obviously but there are just the 3 groups.

      ForgetItNet
      ForgetItNetAuthor
      Explorer II
      May 9, 2025

      I've managed to get this going (sort of)....i removed the IPsec VPN and then set it up again with this guide:

      IKEv2 Dialup IPsec tunnel with Radius and... - Fortinet Community

      It does involve setting up a Radius server and then creating a new group on the Fortgate but setting the users up as Radius users as opposed to LDAP one's but i can enable 2FA on there and it connects with EAS256-SHA256 and DH20 so it's secure....i just need to play around with the users and groups again but i think this should sort it.

      Terms & ConditionsAccessibility statement